From owner-svn-ports-head@FreeBSD.ORG Thu Dec 11 20:56:22 2014 Return-Path: Delivered-To: svn-ports-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id A7A71C94; Thu, 11 Dec 2014 20:56:22 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 926C8EF; Thu, 11 Dec 2014 20:56:22 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id sBBKuMLD066245; Thu, 11 Dec 2014 20:56:22 GMT (envelope-from delphij@FreeBSD.org) Received: (from delphij@localhost) by svn.freebsd.org (8.14.9/8.14.9/Submit) id sBBKuMga066241; Thu, 11 Dec 2014 20:56:22 GMT (envelope-from delphij@FreeBSD.org) Message-Id: <201412112056.sBBKuMga066241@svn.freebsd.org> X-Authentication-Warning: svn.freebsd.org: delphij set sender to delphij@FreeBSD.org using -f From: Xin LI Date: Thu, 11 Dec 2014 20:56:22 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r374548 - head/security/vuxml X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-head@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: SVN commit messages for the ports tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 11 Dec 2014 20:56:22 -0000 Author: delphij Date: Thu Dec 11 20:56:21 2014 New Revision: 374548 URL: https://svnweb.freebsd.org/changeset/ports/374548 QAT: https://qat.redports.org/buildarchive/r374548/ Log: Document BIND vulnerability. Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Thu Dec 11 20:41:52 2014 (r374547) +++ head/security/vuxml/vuln.xml Thu Dec 11 20:56:21 2014 (r374548) @@ -57,6 +57,70 @@ Notes: --> + + bind -- denial of service vulnerability + + + bind99 + bind99-base + 9.9.6 + + + bind98 + bind98-base + bind96 + bind96-base + 0 + + + FreeBSD + 9.39.3_6 + 9.29.2_16 + 9.19.1_23 + 8.48.4_20 + + + + +

ISC reports:

+
We have today posted updated versions of 9.9.6 and 9.10.1 + to address a significant security vulnerability in DNS + resolution. The flaw was discovered by Florian Maury of + ANSSI, and applies to any recursive resolver that does not + support a limit on the number of recursions. [CERTFR-2014-AVI-512], + [USCERT VU#264212]
+
A flaw in delegation handling could be exploited to put named + into an infinite loop, in which each lookup of a name server + triggered additional lookups of more name servers. This has + been addressed by placing limits on the number of levels of + recursion named will allow (default 7), and on the number of + queries that it will send before terminating a recursive query + (default 50). The recursion depth limit is configured via the + max-recursion-depth option, and the query limit via the + max-recursion-queries option. For more information, see the + security advisory at https://kb.isc.org/article/AA-01216/. + [CVE-2014-8500] + [RT #37580]
+
In addition, we have also corrected a potential security + vulnerability in the GeoIP feature in the 9.10.1 release only. + For more information on this issue, see the security advisory + at https://kb.isc.org/article/AA-01217. + [CVE-2014-8680]
+

+ + + + CVE-2014-8500 + CVE-2014-8680 + https://www.isc.org/blogs/important-security-advisory-posted/ + + + 2014-12-08 + 2014-12-11 + + + asterisk -- Remote Crash Vulnerability in WebSocket Server